AIKIDO-2026-10059

TL;DR

Affected versions of this package are vulnerable to an Open Redirect via the redirectToPath query parameter, where setting a schemaless URL, such as //evil.com, would cause a redirection to an external malicious domain due to improper validation. An attacker could exploit this by crafting a phishing link that appears to originate from the trusted site to steal user credentials or deliver malware, which the patched code now mitigates by detecting and blocking schemaless URLs that begin with //.